coding-tool-x 3.3.8 → 3.3.9

package/src/server/api/agents.js

@@ -105,7 +105,7 @@ function getAllowedProjectRoots() {
 
   // 从工作区配置中扩展允许目录，避免误拦截外部磁盘/自定义根目录项目
   try {
-    const workspaceConfigPath = path.join(PATHS.base, 'workspaces.json');
+    const workspaceConfigPath = PATHS.workspaces;
     if (fs.existsSync(workspaceConfigPath)) {
       const raw = fs.readFileSync(workspaceConfigPath, 'utf-8');
       const parsed = JSON.parse(raw || '{}');

package/src/server/api/claude-hooks.js

@@ -5,21 +5,26 @@ const path = require('path');
 const os = require('os');
 const https = require('https');
 const http = require('http');
+const { PATHS, NATIVE_PATHS } = require('../../config/paths');
 const { resolvePreferredHomeDir, normalizeWindowsHomePath } = require('../../utils/home-dir');
+const { createSameOriginGuard } = require('../services/network-access');
 
 // 检测操作系统
 const platform = os.platform(); // 'darwin' | 'win32' | 'linux'
+router.use(createSameOriginGuard({
+  message: '禁止跨站访问 Claude Hooks 配置接口'
+}));
 
 const HOME_DIR = resolvePreferredHomeDir(platform, process.env, os.homedir());
 
 // Claude settings.json 路径
-const CLAUDE_SETTINGS_PATH = path.join(HOME_DIR, '.claude', 'settings.json');
+const CLAUDE_SETTINGS_PATH = NATIVE_PATHS.claude.settings;
 
 // UI 配置路径（记录用户是否主动关闭过、飞书配置等）
-const UI_CONFIG_PATH = path.join(HOME_DIR, '.cc-tool', 'ui-config.json');
+const UI_CONFIG_PATH = PATHS.uiConfig;
 
 // 通知脚本路径（用于飞书通知）
-const NOTIFY_SCRIPT_PATH = path.join(HOME_DIR, '.cc-tool', 'notify-hook.js');
+const NOTIFY_SCRIPT_PATH = PATHS.notifyHook;
 
 // 读取 Claude settings.json
 function readClaudeSettings() {
@@ -222,17 +227,17 @@ function shouldRepairStopHook(settings, expectedScriptPath = NOTIFY_SCRIPT_PATH,
     return false;
   }
 
-  const markerType = parseNotifyTypeMarker(command);
-  if (!markerType) {
-    return false;
-  }
-
   const normalizedCommand = normalizePathForCompare(command);
   const normalizedExpected = normalizePathForCompare(expectedScriptPath);
   if (!normalizedCommand.includes(normalizedExpected)) {
     return true;
   }
 
+  const markerType = parseNotifyTypeMarker(command);
+  if (!markerType) {
+    return true;
+  }
+
   return !fileExists(expectedScriptPath);
 }
 

package/src/server/api/codex-proxy.js

@@ -174,11 +174,12 @@ router.post('/start', async (req, res) => {
     let message = `Codex proxy started on port ${proxyResult.port}, active channel: ${currentChannel.name}`;
     let envHint = null;
 
-    // 只有首次注入环境变量时才提示用户执行 source 命令
-    if (configResult.envInjected && configResult.isFirstTime) {
+    if (configResult.envInjected && configResult.reloadRequired) {
       envHint = {
-        command: configResult.sourceCommand,
-        message: `首次启用需在 Codex 终端执行: ${configResult.sourceCommand}`
+        command: configResult.sourceCommand || null,
+        message: configResult.sourceCommand
+          ? `请在 Codex 终端执行: ${configResult.sourceCommand}`
+          : '请重新打开 Codex 终端以加载新的用户环境变量'
       };
     }
 

package/src/server/api/hooks.js

@@ -0,0 +1,45 @@
+const express = require('express');
+const router = express.Router();
+const notificationHooks = require('../services/notification-hooks');
+const { createSameOriginGuard } = require('../services/network-access');
+
+router.use(createSameOriginGuard({
+  message: '禁止跨站访问通知配置接口'
+}));
+
+router.get('/', (req, res) => {
+  try {
+    res.json(notificationHooks.getNotificationSettings());
+  } catch (error) {
+    console.error('Error getting notification hook settings:', error);
+    res.status(error.statusCode || 500).json({ error: error.message });
+  }
+});
+
+router.post('/', (req, res) => {
+  try {
+    const result = notificationHooks.saveNotificationSettings(req.body || {});
+    res.json({
+      ...result,
+      message: '通知设置已保存'
+    });
+  } catch (error) {
+    console.error('Error saving notification hook settings:', error);
+    res.status(error.statusCode || 500).json({ error: error.message });
+  }
+});
+
+router.post('/test', async (req, res) => {
+  try {
+    await notificationHooks.testNotification(req.body || {});
+    res.json({
+      success: true,
+      message: req.body?.testFeishu ? '飞书测试通知已发送' : '系统测试通知已发送'
+    });
+  } catch (error) {
+    console.error('Error testing notification hook settings:', error);
+    res.status(error.statusCode || 500).json({ error: error.message });
+  }
+});
+
+module.exports = router;

package/src/server/api/plugins.js

@@ -58,7 +58,6 @@ router.get('/market', async (req, res) => {
   try {
     const { platform, service } = getPluginsService(req);
     const forceRefresh = req.query.refresh === '1';
-    if (forceRefresh) service._marketCache = null;
     const plugins = await service.getMarketPlugins(forceRefresh);
 
     res.json({

package/src/server/api/ui-config.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const router = express.Router();
+const { createSameOriginGuard } = require('../services/network-access');
 const {
   loadUIConfig,
   saveUIConfig,
@@ -7,6 +8,10 @@ const {
   updateNestedUIConfig
 } = require('../services/ui-config');
 
+router.use(createSameOriginGuard({
+  message: '禁止跨站访问 UI 配置接口'
+}));
+
 // Get all UI config
 router.get('/', (req, res) => {
   try {

package/src/server/codex-proxy-server.js

@@ -13,6 +13,7 @@ const { saveProxyStartTime, clearProxyStartTime, getProxyStartTime, getProxyRunt
 const { createDecodedStream } = require('./services/response-decoder');
 const { getEffectiveApiKey } = require('./services/codex-channels');
 const { persistProxyRequestSnapshot } = require('./services/request-logger');
+const { publishUsageLog, publishFailureLog } = require('./services/proxy-log-helper');
 
 let proxyServer = null;
 let proxyApp = null;
@@ -270,6 +271,14 @@ async function startCodexProxyServer(options = {}) {
         const effectiveKey = getEffectiveApiKey(channel);
         if (!effectiveKey) {
           release();
+          publishFailureLog({
+            source: 'codex',
+            channel: channel.name,
+            message: 'API key not configured or expired. Please update your channel key.',
+            statusCode: 401,
+            stage: 'preflight',
+            broadcastLog
+          });
           return res.status(401).json({
             error: {
               message: 'API key not configured or expired. Please update your channel key.',
@@ -324,6 +333,20 @@ async function startCodexProxyServer(options = {}) {
           release();
           if (err) {
             recordFailure(channel.id, 'codex', err);
+            const metadata = requestMetadata.get(req) || {
+              channel: channel.name,
+              channelId: channel.id,
+              startTime: Date.now()
+            };
+            publishFailureLog({
+              source: 'codex',
+              metadata,
+              message: err.message,
+              error: err,
+              statusCode: 502,
+              stage: 'proxy_web',
+              broadcastLog
+            });
             console.error('Codex proxy error:', err);
             if (res && !res.headersSent) {
               res.status(502).json({
@@ -337,6 +360,13 @@ async function startCodexProxyServer(options = {}) {
         });
       } catch (error) {
         console.error('Codex channel allocation error:', error);
+        publishFailureLog({
+          source: 'codex',
+          message: error.message || 'No Codex channel available',
+          statusCode: 503,
+          stage: 'allocate_channel',
+          broadcastLog
+        });
         if (!res.headersSent) {
           res.status(503).json({
             error: {
@@ -389,8 +419,40 @@ async function startCodexProxyServer(options = {}) {
         totalTokens: 0,
         model: ''
       };
+      let usageRecorded = false;
       const parsedStream = createDecodedStream(proxyRes);
 
+      function recordUsageIfReady() {
+        if (usageRecorded) {
+          return false;
+        }
+
+        const result = publishUsageLog({
+          source: 'codex',
+          metadata,
+          model: tokenData.model,
+          tokens: {
+            input: tokenData.inputTokens,
+            output: tokenData.outputTokens,
+            cached: tokenData.cachedTokens,
+            reasoning: tokenData.reasoningTokens,
+            total: tokenData.totalTokens
+          },
+          calculateCost,
+          broadcastLog,
+          recordRequest: recordCodexRequest,
+          recordSuccess,
+          allowBroadcast: !isResponseClosed
+        });
+
+        if (!result) {
+          return false;
+        }
+
+        usageRecorded = true;
+        return true;
+      }
+
       parsedStream.on('data', (chunk) => {
         // 如果响应已关闭，停止处理
         if (isResponseClosed) {
@@ -455,7 +517,10 @@ async function startCodexProxyServer(options = {}) {
                 // 兼容 Responses API 和 Chat Completions API
                 tokenData.inputTokens = parsed.usage.input_tokens || parsed.usage.prompt_tokens || 0;
                 tokenData.outputTokens = parsed.usage.output_tokens || parsed.usage.completion_tokens || 0;
+                tokenData.totalTokens = parsed.usage.total_tokens || (tokenData.inputTokens + tokenData.outputTokens);
               }
+
+              recordUsageIfReady();
             } catch (err) {
               // 忽略解析错误
             }
@@ -475,71 +540,14 @@ async function startCodexProxyServer(options = {}) {
               // 兼容两种格式
               tokenData.inputTokens = parsed.usage.input_tokens || parsed.usage.prompt_tokens || 0;
               tokenData.outputTokens = parsed.usage.output_tokens || parsed.usage.completion_tokens || 0;
+              tokenData.totalTokens = parsed.usage.total_tokens || (tokenData.inputTokens + tokenData.outputTokens);
             }
           } catch (err) {
             // 忽略解析错误
           }
         }
 
-        // 只有当有 token 数据时才记录
-        if (tokenData.inputTokens > 0 || tokenData.outputTokens > 0) {
-          const now = new Date();
-          const time = now.toLocaleTimeString('zh-CN', {
-            hour12: false,
-            hour: '2-digit',
-            minute: '2-digit',
-            second: '2-digit'
-          });
-
-          // 记录统计数据（先计算）
-          const tokens = {
-            input: tokenData.inputTokens,
-            output: tokenData.outputTokens,
-            total: tokenData.inputTokens + tokenData.outputTokens
-          };
-          const cost = calculateCost(tokenData.model, tokens);
-
-          // 广播日志（仅当响应仍然开放时）
-          if (!isResponseClosed) {
-            broadcastLog({
-              type: 'log',
-              id: metadata.id,
-              time: time,
-              channel: metadata.channel,
-              model: tokenData.model,
-              inputTokens: tokenData.inputTokens,
-              outputTokens: tokenData.outputTokens,
-              cachedTokens: tokenData.cachedTokens,
-              reasoningTokens: tokenData.reasoningTokens,
-              totalTokens: tokenData.totalTokens,
-              cost: cost,
-              source: 'codex'
-            });
-          }
-
-          const duration = Date.now() - metadata.startTime;
-
-          recordCodexRequest({
-            id: metadata.id,
-            timestamp: new Date(metadata.startTime).toISOString(),
-            toolType: 'codex',
-            channel: metadata.channel,
-            channelId: metadata.channelId,
-            model: tokenData.model,
-            tokens: {
-              input: tokenData.inputTokens,
-              output: tokenData.outputTokens,
-              reasoning: tokenData.reasoningTokens,
-              cached: tokenData.cachedTokens,
-              total: tokens.total
-            },
-            duration: duration,
-            success: true,
-            cost: cost
-          });
-
-          recordSuccess(metadata.channelId, 'codex');
-        }
+        recordUsageIfReady();
 
         if (!isResponseClosed) {
           requestMetadata.delete(req);
@@ -553,6 +561,15 @@ async function startCodexProxyServer(options = {}) {
         }
         isResponseClosed = true;
         recordFailure(metadata.channelId, 'codex', err);
+        publishFailureLog({
+          source: 'codex',
+          metadata,
+          message: err.message,
+          error: err,
+          statusCode: proxyRes.statusCode,
+          stage: 'response_stream',
+          broadcastLog
+        });
         requestMetadata.delete(req);
       });
     });
@@ -565,6 +582,19 @@ async function startCodexProxyServer(options = {}) {
         releaseChannel(req.selectedChannel.id, 'codex');
         broadcastSchedulerState('codex', getSchedulerState('codex'));
       }
+      publishFailureLog({
+        source: 'codex',
+        metadata: (req && requestMetadata.get(req)) || {
+          channel: req?.selectedChannel?.name,
+          channelId: req?.selectedChannel?.id,
+          model: req?.body?.model
+        },
+        message: err.message,
+        error: err,
+        statusCode: 502,
+        stage: 'proxy',
+        broadcastLog
+      });
       if (res && !res.headersSent) {
         res.status(502).json({
           error: {

package/src/server/gemini-proxy-server.js

@@ -13,6 +13,7 @@ const { saveProxyStartTime, clearProxyStartTime, getProxyStartTime, getProxyRunt
 const { createDecodedStream } = require('./services/response-decoder');
 const { getEffectiveApiKey } = require('./services/gemini-channels');
 const { persistProxyRequestSnapshot } = require('./services/request-logger');
+const { publishUsageLog, publishFailureLog } = require('./services/proxy-log-helper');
 
 let proxyServer = null;
 let proxyApp = null;
@@ -186,6 +187,14 @@ async function startGeminiProxyServer(options = {}) {
         const effectiveKey = getEffectiveApiKey(channel);
         if (!effectiveKey) {
           release();
+          publishFailureLog({
+            source: 'gemini',
+            channel: channel.name,
+            message: 'API key not configured or expired. Please update your channel key.',
+            statusCode: 401,
+            stage: 'preflight',
+            broadcastLog
+          });
           return res.status(401).json({
             error: {
               message: 'API key not configured or expired. Please update your channel key.',
@@ -241,6 +250,20 @@ async function startGeminiProxyServer(options = {}) {
           release();
           if (err) {
             recordFailure(channel.id, 'gemini', err);
+            const metadata = requestMetadata.get(req) || {
+              channel: channel.name,
+              channelId: channel.id,
+              startTime: Date.now()
+            };
+            publishFailureLog({
+              source: 'gemini',
+              metadata,
+              message: err.message,
+              error: err,
+              statusCode: 502,
+              stage: 'proxy_web',
+              broadcastLog
+            });
             console.error('Gemini proxy error:', err);
             if (res && !res.headersSent) {
               res.status(502).json({
@@ -254,6 +277,13 @@ async function startGeminiProxyServer(options = {}) {
         });
       } catch (error) {
         console.error('Gemini channel allocation error:', error);
+        publishFailureLog({
+          source: 'gemini',
+          message: error.message || 'No Gemini channel available',
+          statusCode: 503,
+          stage: 'allocate_channel',
+          broadcastLog
+        });
         if (!res.headersSent) {
           res.status(503).json({
             error: {
@@ -306,8 +336,44 @@ async function startGeminiProxyServer(options = {}) {
         totalTokens: 0,
         model: ''
       };
+      let usageRecorded = false;
       const parsedStream = createDecodedStream(proxyRes);
 
+      function recordUsageIfReady() {
+        if (usageRecorded) {
+          return false;
+        }
+
+        if (!tokenData.model && metadata.modelFromUrl) {
+          tokenData.model = metadata.modelFromUrl;
+        }
+
+        const result = publishUsageLog({
+          source: 'gemini',
+          metadata,
+          model: tokenData.model,
+          tokens: {
+            input: tokenData.inputTokens,
+            output: tokenData.outputTokens,
+            cached: tokenData.cachedTokens,
+            reasoning: tokenData.reasoningTokens,
+            total: tokenData.totalTokens
+          },
+          calculateCost,
+          broadcastLog,
+          recordRequest: recordGeminiRequest,
+          recordSuccess,
+          allowBroadcast: !isResponseClosed
+        });
+
+        if (!result) {
+          return false;
+        }
+
+        usageRecorded = true;
+        return true;
+      }
+
       parsedStream.on('data', (chunk) => {
         // 如果响应已关闭，停止处理
         if (isResponseClosed) {
@@ -347,30 +413,27 @@ async function startGeminiProxyServer(options = {}) {
               }
 
               // 提取 usage 信息 (支持 OpenAI 和 Gemini 原生格式)
-              if (tokenData.inputTokens === 0) {
-                // OpenAI 格式
-                if (parsed.usage) {
-                  tokenData.inputTokens = parsed.usage.prompt_tokens || parsed.usage.input_tokens || 0;
-                  tokenData.outputTokens = parsed.usage.completion_tokens || parsed.usage.output_tokens || 0;
-                  tokenData.totalTokens = parsed.usage.total_tokens || 0;
-
-                  // Gemini 可能包含缓存信息
-                  if (parsed.usage.prompt_tokens_details) {
-                    tokenData.cachedTokens = parsed.usage.prompt_tokens_details.cached_tokens || 0;
-                  }
+              if (parsed.usage) {
+                tokenData.inputTokens = parsed.usage.prompt_tokens || parsed.usage.input_tokens || 0;
+                tokenData.outputTokens = parsed.usage.completion_tokens || parsed.usage.output_tokens || 0;
+                tokenData.totalTokens = parsed.usage.total_tokens || 0;
+
+                // Gemini 可能包含缓存信息
+                if (parsed.usage.prompt_tokens_details) {
+                  tokenData.cachedTokens = parsed.usage.prompt_tokens_details.cached_tokens || 0;
                 }
-                // Gemini 原生格式
-                else if (parsed.usageMetadata) {
-                  tokenData.inputTokens = parsed.usageMetadata.promptTokenCount || 0;
-                  tokenData.outputTokens = parsed.usageMetadata.candidatesTokenCount || 0;
-                  tokenData.totalTokens = parsed.usageMetadata.totalTokenCount || 0;
-
-                  // Gemini 缓存信息
-                  if (parsed.usageMetadata.cachedContentTokenCount) {
-                    tokenData.cachedTokens = parsed.usageMetadata.cachedContentTokenCount;
-                  }
+              } else if (parsed.usageMetadata) {
+                tokenData.inputTokens = parsed.usageMetadata.promptTokenCount || 0;
+                tokenData.outputTokens = parsed.usageMetadata.candidatesTokenCount || 0;
+                tokenData.totalTokens = parsed.usageMetadata.totalTokenCount || 0;
+
+                // Gemini 缓存信息
+                if (parsed.usageMetadata.cachedContentTokenCount) {
+                  tokenData.cachedTokens = parsed.usageMetadata.cachedContentTokenCount;
                 }
               }
+
+              recordUsageIfReady();
             } catch (err) {
               // 忽略解析错误
             }
@@ -412,73 +475,7 @@ async function startGeminiProxyServer(options = {}) {
           }
         }
 
-        // 如果没有从响应中提取到模型，使用 URL 中的模型
-        if (!tokenData.model && metadata.modelFromUrl) {
-          tokenData.model = metadata.modelFromUrl;
-        }
-
-        // 记录日志和统计
-        const now = new Date();
-        const time = now.toLocaleTimeString('zh-CN', {
-          hour12: false,
-          hour: '2-digit',
-          minute: '2-digit',
-          second: '2-digit'
-        });
-
-        // 记录统计数据（先计算）
-        const tokens = {
-          input: tokenData.inputTokens,
-          output: tokenData.outputTokens,
-          total: tokenData.totalTokens || (tokenData.inputTokens + tokenData.outputTokens)
-        };
-        const cost = calculateCost(tokenData.model, tokens);
-
-        // 只有在有 token 数据时才广播日志和记录统计
-        if (tokenData.inputTokens > 0 || tokenData.outputTokens > 0 || tokenData.totalTokens > 0) {
-          // 广播日志（仅当响应仍然开放时）
-          if (!isResponseClosed) {
-            const logData = {
-              type: 'log',
-              id: metadata.id,
-              time: time,
-              channel: metadata.channel,
-              model: tokenData.model,
-              inputTokens: tokenData.inputTokens,
-              outputTokens: tokenData.outputTokens,
-              cachedTokens: tokenData.cachedTokens,
-              reasoningTokens: tokenData.reasoningTokens,
-              totalTokens: tokenData.totalTokens || (tokenData.inputTokens + tokenData.outputTokens),
-              cost: cost,
-              source: 'gemini'
-            };
-
-            broadcastLog(logData);
-          }
-
-          // 记录统计
-          const duration = Date.now() - metadata.startTime;
-
-          recordGeminiRequest({
-            id: metadata.id,
-            timestamp: new Date(metadata.startTime).toISOString(),
-            toolType: 'gemini',
-            channel: metadata.channel,
-            channelId: metadata.channelId,
-            model: tokenData.model,
-            tokens: {
-              input: tokenData.inputTokens,
-              output: tokenData.outputTokens,
-              cached: tokenData.cachedTokens,
-              total: tokens.total
-            },
-            duration: duration,
-            success: true,
-            cost: cost
-          });
-
-          recordSuccess(metadata.channelId, 'gemini');
-        }
+        recordUsageIfReady();
 
         if (!isResponseClosed) {
           requestMetadata.delete(req);
@@ -492,6 +489,15 @@ async function startGeminiProxyServer(options = {}) {
         }
         isResponseClosed = true;
         recordFailure(metadata.channelId, 'gemini', err);
+        publishFailureLog({
+          source: 'gemini',
+          metadata,
+          message: err.message,
+          error: err,
+          statusCode: proxyRes.statusCode,
+          stage: 'response_stream',
+          broadcastLog
+        });
         requestMetadata.delete(req);
       });
     });
@@ -504,6 +510,19 @@ async function startGeminiProxyServer(options = {}) {
         releaseChannel(req.selectedChannel.id, 'gemini');
         broadcastSchedulerState('gemini', getSchedulerState('gemini'));
       }
+      publishFailureLog({
+        source: 'gemini',
+        metadata: (req && requestMetadata.get(req)) || {
+          channel: req?.selectedChannel?.name,
+          channelId: req?.selectedChannel?.id,
+          model: req?.body?.model
+        },
+        message: err.message,
+        error: err,
+        statusCode: 502,
+        stage: 'proxy',
+        broadcastLog
+      });
       if (res && !res.headersSent) {
         res.status(502).json({
           error: {

package/src/server/index.js

@@ -200,6 +200,7 @@ async function startServer(port, host = '127.0.0.1', options = {}) {
   app.use('/api/skills', require('./api/skills'));
   const claudeHooks = require('./api/claude-hooks');
   app.use('/api/claude/hooks', claudeHooks);
+  app.use('/api/hooks', require('./api/hooks'));
 
   // 初始化 Claude hooks 默认配置（自动开启任务完成通知）
   claudeHooks.initDefaultHooks();